5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5

Analysis

max time kernel
150s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
Size

55KB
MD5

ffa8b66f8c550173b920d5657d538f40
SHA1

922de8387eb272ac6232429b09ab85f1f44eb056
SHA256

5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5
SHA512

3010de950b44f6dda845b7a1d918d58d6f0cee4ec17514a77ce27229b1f5932f93c43564c04c1df18aac0b7e4f077e5a5d77848ec9c23261dd988be6031c9bd4
SSDEEP

768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFkTfq9Tfq7h6hWh2hQ:W7ZppApBULcfpHLcfpyDc2ih6hWh2hQ

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Trial-ul-oob.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-180.png.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-phn.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-pl.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-ul-oob.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\j2pkcs11.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\DBGHELP.DLL.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.White.png.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jre-1.8\lib\management-agent.jar.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-oob.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-pl.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jre-1.8\lib\calendars.properties.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bg.pak.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ppd.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\msvcr120.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-180.png.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\Microsoft.VisualBasic.Forms.resources.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Overlapped.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationClientSideProviders.resources.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\java.policy.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ppd.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\STSLISTI.DLL.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\upe.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BKANT.TTF.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Xaml.resources.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\DirectWriteForwarder.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-oob.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\COIN.WAV.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\WindowsFormsIntegration.resources.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\WindowsFormsIntegration.resources.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32ww.msi.16.x-none.xml.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\InputPersonalization.exe.mui.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Memory.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_MAK_AE-ul-phn.xrm-ms.tmp	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe

C:\Users\Admin\AppData\Local\Temp\5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe
"C:\Users\Admin\AppData\Local\Temp\5e3c1635333756efc3b1cad649753e175c986284f748ff5c7e72d6a854a9d2c5N.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-355097885-2402257403-2971294179-1000\desktop.ini.tmp

Filesize
55KB

MD5
40000727cfa69928999d5fd92b7944b8

SHA1
0bfc11b6d616ece589e0e577c5ce88141a55a5f4

SHA256
055f6f6aada679abbbd167ee505c1407c873c2fd7edadef25b94d8a2c5965287

SHA512
16de7f3b07eebc5e6b9d3bb79ceaf70de0ad3fd9163117fdce928c806ef0d4687dfce838fedbc05108736f3622a13cea99d213d4ab5c250e0cb1f752d3a0be02

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
154KB

MD5
43b74c896ee661a70a384bf6dd32cd66

SHA1
4e67ed07afc6e9d0fe81c4934f0fd3f3ba1d268a

SHA256
6c6422300f6ecbb5d4b584d8269e87893967cb1b16344ddc69040dbcbb660ee8

SHA512
4a38f882dd823199674909bbc2f570bfbc8c96daa9398185509bcfc3e873ec34e4342add7006e41736b4cb93a1442bf64fbee1506fd28b6506884addf29181e9

Download Submit